Cloudflare Zero Trust 101
Part 1: Architecture & Preparation + Part 2: Implementation

Example Deployment Phases

A staged deployment of Zero Trust is recommended. Below are examples of typical deployment phases. By setting success criteria for each phase and confirming no issues before proceeding to the next, you can minimize risk.

Best Practices by Phase

Phase	Best Practices	Reference
Phase 1	Select a technically capable team such as the IT department for the pilot group Test IdP integration with the same settings as the production environment Create multiple WARP Profiles to separate pilot and production	Get started →
Phase 2	Start DNS policies in "log only" mode, then switch to block after verifying impact Start Split Tunnel in Exclude mode, then migrate to Include mode as needed Survey each department's business apps in advance and prepare exclusion lists	Build DNS policies →
Phase 3	Prepare Do Not Inspect lists before enabling TLS Decryption (for certificate pinning compatibility) Start HTTP policies in "log only" mode and check for false positives Consider excluding video conferencing apps (Zoom, Teams, etc.) via Split Tunnel	TLS decryption →
Phase 4	Start CASB with high-priority SaaS (M365, Google Workspace) Start DLP with Managed Profiles and add custom patterns incrementally Apply RBI only to high-risk categories, not all traffic	CASB setup →

Common Deployment Challenges & Countermeasures

Cloudflare Docs — Get started with Zero Trust

Setting the Team Name

Select Zero Trust from the account menu in the Cloudflare dashboard and set your Team name. The Team name can be changed later, but it is used in the URL yourteam.cloudflareaccess.com.

1. Click Zero Trust from the Cloudflare dashboard
2. Specify a Team name
3. Set the subscription plan and payment method

Cloudflare Docs — Start from the Dashboard

Authentication Method Setup (IdP)

Why is IdP integration necessary?

Cloudflare Zero Trust delegates user identity verification (authentication) to an external Identity Provider (IdP), enabling secure and centralized access management.

Where IdP is Used

Supported IdP Provider List

Cloudflare Zero Trust supports all major Identity Providers. You can check the setup instructions for each IdP from the links below.

IdP Provider	Protocol	Setup Documentation
Microsoft Entra ID (formerly Azure AD)	OIDC / SAML	Setup guide →
Okta	OIDC / SAML	Setup guide →
Google Workspace	OIDC	Setup guide →
OneLogin	OIDC / SAML	Setup guide →
PingIdentity / PingOne	OIDC / SAML	Setup guide →
GitHub	OAuth	Setup guide →
LinkedIn	OAuth	Setup guide →
Facebook	OAuth	Setup guide →
Generic SAML 2.0	SAML	Setup guide →
Generic OIDC	OIDC	Setup guide →

Cloudflare Docs — Identity provider integrations

Microsoft Entra ID Configuration Example

Below are the integration steps for Microsoft Entra ID (formerly Azure AD):

1. Prepare your IdP (e.g., Microsoft Entra ID)
2. Click Integrations > Identity providers from the Zero Trust dashboard
3. From the "Login methods" card, click "Add New" → Select IdP → Enter required fields → "Save"
4. Confirm successful connection with the "Test" button

Field	Setting
Name	Display name on the SSO login page (e.g., "Microsoft Entra ID")
Application ID	Obtained from Microsoft Entra ID (UUID format)
Application Secret	Obtained from Microsoft Entra ID
Directory ID	Obtained from Microsoft Entra ID (UUID format)
Azure Cloud	Select Default in most cases

SCIM Sync: With SCIM integration with Entra ID, you can automatically sync user additions, deletions, and attribute changes.

Dashboard SSO Registration (Optional)

You can route Cloudflare Dashboard authentication through the SSO specified in Zero Trust.

1. Request your CSM to create an SSO Connector (provide the email domain to be used)
2. Enable the target domain in the "Cloudflare dashboard SSO" card under Integrations > Identity providers
3. While keeping the admin panel open, verify SSO operation in a separate browser / Incognito window
4. Complete when verification is OK. If issues arise, disable the SSO card and investigate

Logpush Setup (Enterprise)

Log data can be forwarded to an external SIEM / LMS. There are two methods: Logpush (recommended) and Logpull. Using the API enables more flexible configuration.

Why is Logpush necessary?

Logpush is important for Enterprise plan customers for the following reasons:

Challenge	Dashboard Logs	Logpush
Retention period	Short-term (days to weeks)	Unlimited (depends on external storage)
Data accuracy	Sampling-based (not all data)	100% complete log data
Long-term investigation	Difficult (data is lost)	Supports audit & incident investigation
SIEM integration	Not available	Integrates with Splunk, Datadog, Sumo Logic, etc.

Setup Steps from the Dashboard

Steps to configure Logpush from the Zero Trust dashboard:

1. Click Logs > Logpush from the Zero Trust dashboard
2. Click the "Connect a Service" button
3. Select the datasets to forward (multiple selections possible)
4. Click "Next" → Select a Storage Service (R2, S3, Azure Blob, GCS, Splunk, etc.)
5. Enter storage credentials → Verify connection with "Validate access"
6. Click "Save and Start Pushing" to complete

Zero Trust Dataset List

Zero Trust-related datasets that can be forwarded via Logpush:

Dataset	Description
Access Requests	HTTP requests to applications protected by Access
Audit Logs	Audit logs of configuration changes and administrative operations within the account
Browser Isolation User Actions	User actions within remote browser isolation sessions
CASB Findings	Security issues detected by CASB
Device Posture Results	Device Posture evaluation results from the WARP client
DEX Application Tests	Digital Experience Monitoring application test results
DEX Device State Events	Digital Experience Monitoring device state events
Gateway DNS	DNS query information detected by Gateway
Gateway HTTP	HTTP requests detected by Gateway
Gateway Network	Network session information detected by Gateway
SSH Logs	SSH session logs via Access for Infrastructure
WARP Config Changes	WARP client device profile configuration changes
WARP Toggle Events	WARP client enable/disable events
Zero Trust Network Session Logs	Detailed logs of Zero Trust network sessions

Cloudflare Docs — Logpush integration

Important Log Fields

Log Type	Field	Description
Gateway DNS / Gateway HTTP	Action	Actions such as Allow / Block / Isolate
Gateway DNS / Gateway HTTP	UserEmail	User who made the request
Gateway DNS / Gateway HTTP	DeviceID	Identifier of the requesting device
Gateway DNS / Gateway HTTP	PolicyName	Name of the applied policy
Access	Allowed	Whether access was permitted
Access	AppUID	ID of the accessed application
Device Posture	PostureCheckType	Type of posture check evaluated
Device Posture	Success	Pass/fail result of the posture check

Log Retrieval Example via Logpull API

Below is a command example to retrieve Logpush logs stored in R2 via the API. It fetches logs for a specified period in JSON format and formats them with jq for display.

WARP Architecture

The WARP client connects to Cloudflare Gateway through a DNS proxy and Virtual interface on the device. It forwards DNS queries via DoH (DNS over HTTPS) and controls L3/L4 traffic through WireGuard or MASQUE tunnels.

Tunnel Protocol Comparison

WARP Client Download and Installation

The WARP client is available on the following platforms:

Cloudflare Docs — Download WARP

Installation Methods

There are two methods for installing the WARP client: Manual Installation and MDM (Mobile Device Management).

Cloudflare Docs — MDM deployment

Installation Steps (Common)

1. Upload custom root certificate to Cloudflare (optional)
2. Enable "Install CA to system certificate store" in Team & Resources > Devices > WARP Client
3. Download and install the WARP client
4. Register the device to the Zero Trust Team

Command Line Installation Examples

Coexistence with Legacy VPN

Defining Device Enrollment Permissions

Specify the target users who are allowed to access the WARP Team.

1. Select "Manage" from the "Device enrollment" card in Team & Resources > Devices > WARP Client
2. Define authorized users in the "Rules" tab (e.g., domain match, group membership, etc.)
3. Select available IdPs in the "Authentication" tab
4. Click the "Save" button

Logging in to the Zero Trust Instance

1. Click the Cloudflare icon from the menu bar
2. Settings icon → Preferences > Account
3. Select "Login with Cloudflare Zero Trust"
4. Enter the Team name → Complete the authentication steps

Cloudflare Docs — Manual deployment

WARP Connection Modes

The WARP client supports multiple connection modes, allowing flexible selection based on organizational security requirements and deployment stages. Available Gateway features differ by mode.

Connection Mode	Requirements	DNS Filtering	HTTP Filtering	Network Filtering	Use Case
Gateway with WARP	WARP Client	✅	✅	✅	Full Zero Trust protection. Recommended for corporate devices
Gateway with DoH	DoH-compatible browser / OS	✅	❌	❌	DNS-level protection only. Suitable for BYOD and initial deployment
DNS Locations	Router / Network settings	✅	❌	❌	Office-wide DNS filtering. Agentless
Proxy Endpoint (PAC)	PAC file configuration	✅	✅	❌	HTTP filtering in environments where WARP is not supported

Differences Between Gateway with WARP and Gateway with DoH

Cloudflare Docs — Connect devices

WARP Client Detailed Settings

What is a WARP Device Profile?

WARP Device Profile is a mechanism for grouping WARP client settings and applying them to specific users or devices. By creating multiple profiles, you can achieve flexible configuration management based on department, role, or deployment phase.

Cloudflare Docs — Device profiles

Key Configuration Items

Setting	Description
Switch Lock	Prevents users from disabling WARP. Recommended to disable during pilot deployment phase
Auto Connect	Automatically re-enables WARP after a set period when disabled
Auto Updates	Recommended to disable for stability. Maintain managed versions via MDM
Split Tunnels	Configure traffic that bypasses WARP by IP / domain. Why needed: Video conferencing apps (Zoom, Google Meet, Microsoft Teams, etc.) consume significant bandwidth and may experience latency when routed through WARP. Excluding this traffic maintains meeting quality while ensuring security. Configuration examples: *.zoom.us — Zoom *.google.com, meet.google.com — Google Meet *.teams.microsoft.com — Microsoft Teams *.webex.com — Cisco Webex
Local Domain Fallback	Setting to delegate domain name resolution within private networks to internal DNS servers. Why needed: When accessing internal intranets (e.g., intranet.company.local) or internal systems, Cloudflare's DNS cannot resolve these names. This setting forwards DNS queries for specified domains to internal DNS servers, enabling access to internal resources.
Managed Network	Automatically switches WARP Profile based on the connected network (internal / external). Why needed: In the office, direct access to internal printers, file servers, and internal systems is required. By bypassing WARP when connected to the corporate network and enabling WARP when external (home, cafe, etc.), you can balance convenience and security. Configuration example: Identify the corporate network using TLS certificate hash values or specific IP address ranges
Virtual Network	A feature that allows connecting multiple private networks with overlapping IP addresses without conflicts. Why needed: Even when production and staging environments use the same 10.128.0.0/24, they can be managed as separate Virtual Networks. Also effective for network consolidation during M&A / organizational mergers. Benefits: Resolving IP overlaps (production/staging, post-M&A consolidation, etc.) Automatic Split Tunnel updates (Include list auto-updates when Private Network is added to Tunnel) Switch destination Virtual Network from the WARP client GUI Prerequisites: Install cloudflared on each private network Deploy WARP client on user devices

Checking Logs

warp-diag Command

When to use: Used when troubleshooting WARP client connection issues or performance problems. This command generates a diagnostic file containing WARP settings, connection status, network information, error logs, and more. Attaching this file when contacting support helps expedite issue identification. For details, refer to the WARP Troubleshooting Guide.

Checking from the Dashboard

From the Zero Trust dashboard, you can check the status of registered devices and users in real time.

WARP CGNAT IP Range

When a WARP client connects, the device is assigned a virtual IP address in the CGNAT (Carrier-Grade NAT) range. This IP address is used to uniquely identify devices within Cloudflare's network.

Cloudflare Docs — WARP client IP addresses

Protocol	CGNAT IP Range	Purpose
IPv4	100.96.0.0/12	Virtual IPv4 address for WARP-connected devices
IPv6	fd00::/8 (ULA range)	Virtual IPv6 address for WARP-connected devices

Role of CGNAT:

• Device Identification — Assigns a unique virtual IP to each WARP-connected device, used for policy enforcement and logging
• Private Network Access — Functions as the source IP when accessing private resources via Tunnel
• Gateway Policies — Enables traffic control on a per-user/device basis

If You Have Connection Issues: Checking Firewall Settings

If your organization's firewall restricts internet traffic, you need to allow the IP addresses and domains required for WARP client connections.

Cloudflare Docs — WARP with Firewall

Purpose	IP / Domain	Port
Client API	162.159.137.105, 162.159.138.105 zero-trust-client.cloudflareclient.com	TCP 443
WireGuard Ingress	162.159.193.0/24	UDP 2408, 500, 1701, 4500
MASQUE Ingress	162.159.197.0/24	UDP/TCP 443, UDP 4443, 8443, 8095
Authentication Endpoint	<team-name>.cloudflareaccess.com + IdP domain	TCP 443

What is Cloudflare Access (ZTNA)

Cloudflare Access is a service that implements Zero Trust Network Access (ZTNA). It replaces traditional VPNs and controls access to applications based on the Zero Trust principle of "never trust, always verify."

Differences from Traditional VPN

Aspect	Traditional VPN	Cloudflare Access (ZTNA)
Access Scope	Access to entire network (excessive privileges)	Access only to required applications (least privilege)
Authentication Timing	Authenticated once at connection time	Continuously verified with each request
Device Verification	Limited (certificate-based, etc.)	Verifies device posture (OS version, disk encryption, EDR status, etc.)
User Experience	Requires launching and connecting VPN client	Direct access from browser (for Self-hosted)
Management Overhead	Requires VPN server operation and maintenance	Provided as a cloud service (no operation required)

What Access Can Do

• Per-application access control — Define granularly "who" can access each app from "which device"
• Device posture verification — Add conditions such as OS version, disk encryption, firewall status, and EDR running status
• IdP integration — Integrate with existing IdPs such as Okta, Microsoft Entra ID, and Google Workspace to enable SSO
• Context-based policies — Access control based on time of day, geographic location, risk score, etc.
• Continuous session verification — Even after authentication, access is blocked if conditions change

Access Control via Device Posture

By leveraging device posture, you can allow access only from approved devices and block access from unapproved devices.

Verification Item	Description	Use Case
Serial Number	Match device serial number against a list	Allow access only from company-issued devices, restrict BYOD
Disk Encryption	Verify FileVault (Mac), BitLocker (Windows) is enabled	Data protection compliance
OS Version	Require minimum OS version	Allow only devices with security patches applied
Firewall	Verify OS firewall is enabled	Verify basic security measures

Third-Party Integration (EDR / Endpoint Security)

Cloudflare integrates with major EDR/endpoint security products to verify device security status in real time.

Benefits of integration:

• Real-time risk assessment — Control access based on CrowdStrike's Zero Trust Assessment score
• Automatic blocking on threat detection — Immediately block access from devices where EDR has detected malware
• Compliance verification — Integrate with MDM (Intune, Jamf) to allow access only from managed devices

Cloudflare Docs — Device posture Cloudflare Docs — Access policies

ZTNA Use Case Assessment

Before deploying Cloudflare Access + Tunnel, it's important to review the customer's application architecture and select the appropriate configuration method.

App Type	Examples	Access	Tunnel	Description
Self-hosted	Internal web apps, Jenkins, GitLab, internal portals	✅ Required	✅ Required	Securely expose apps in on-premises or private cloud via the internet. Connect via Tunnel without opening firewall inbound ports.
SaaS Apps	Salesforce, Workday, Box, ServiceNow	✅ Required	❌ Not needed	SaaS apps already published on the internet. Use Access as an identity broker via SAML/OIDC integration. Tunnel is not needed.
Private Network	SSH, RDP, internal APIs, databases	✅ Required	✅ Required	Resources accessible only via private IP. Access through WARP client.

Application Registration

Differences Between Self-hosted and Private Network

Aspect	Self-hosted	Private network
Access Method	Access via public hostname (URL) https://app.example.com	Access via private IP 192.168.1.100:8080
Client Requirements	Browser only (WARP not required)	WARP client required
Protocol	HTTP/HTTPS only	Any (SSH, RDP, TCP/UDP, etc.)
Use Case	When you want to expose web apps externally	When non-HTTP protocols or internal IP access is required

Self-hosted Application Setup Steps

Below are the basic steps for registering a Self-hosted application in Cloudflare Access.

1. Go to Access controls > Applications and select "Add an application" → Self-hosted
2. Configure Application Name / Domain
3. Define Access Policy (who can access)
4. Configure Authentication settings

Cloudflare Docs — Add a self-hosted application

Site Registration

To expose a Self-hosted application via Public Hostname, you need to register the domain with Cloudflare.

Tunnel Configuration (Optional)

Cloudflare Tunnel is a service that securely connects on-premises and private cloud servers to Cloudflare's edge. It uses software called cloudflared (Connector) for the connection. Since the tunnel is established using only outbound (Egress) traffic, there is no need to open firewall inbound ports.

Tunnel Setup Steps

1. Navigate to Networks > Connectors > Cloudflare Tunnels → "Create a tunnel"
2. Set the Tunnel name → Run the displayed command on the server to create the Connector
3. Configure routing (Public Hostnames or Private Networks tab)
4. Click the "Save tunnel" button

Cloudflare Tunnel Use Cases

Cloudflare Tunnel can be used in a variety of scenarios. Below are the most common use cases:

Use Case	Description	Required Components
Publishing Web Apps	Securely publish internal web applications (Jenkins, GitLab, internal portals, etc.) over the internet. Accessible from a browser without a VPN.	Tunnel + Access + Public Hostname
SSH / RDP Access	Developers and system administrators connect to servers remotely via SSH/RDP. Browser-based terminal (Browser Rendering) is also available.	Tunnel + Access + cloudflared (client-side)
Private Network Access (WARP to Tunnel)	Access private IP resources (internal APIs, databases, file servers, etc.) via the WARP client.	Tunnel + WARP + Private Network configuration
Temporary Dev Environment Exposure	Temporarily expose a local development environment externally for testing or demos. Instantly publishable with cloudflared tunnel --url.	cloudflared (Quick Tunnel)
Multi-cloud / Hybrid Connectivity	Connect and manage multiple environments (AWS, Azure, GCP, on-premises, etc.) in a unified manner via Cloudflare.	Tunnel Connector in each environment

Tunnel Capacity and Sizing

Unlike traditional VPNs, Tunnel throughput is primarily limited not by server memory or CPU, but by the number of ports available on the system.

Item	Recommended Value	Notes
Baseline Configuration	2 replicas / location	For redundancy and traffic distribution
Host Specs	4GB RAM / 4 CPU cores (minimum)	For the cloudflared process
Port Allocation	50,000 ports / host	For TCP/UDP traffic
User Capacity Estimate	Approx. 4,000 users / host	A 2-host configuration supports approx. 8,000 users

Cloudflare Docs — Tunnel capacity for cloudflared

WARP to Tunnel (Private Network Access)

WARP to Tunnel is a configuration that uses the WARP client to access resources within a private network. It can completely replace a traditional VPN.

Setup Steps:

1. Create a Tunnel and install cloudflared in your on-premises environment
2. Add private IP ranges (CIDR) in the Tunnel's "Private Networks" tab
   Example: 192.168.1.0/24, 10.0.0.0/8
3. Verify that the added IP ranges are Included in the WARP Split Tunnel settings
   * In Exclude mode, remove the relevant IPs from the exclusion list
4. Configure Access Policies to restrict which users/groups can access

Cloudflare Docs — Connect private networks

For Individual Developers: Quick Tunnel

Quick Tunnel (formerly TryCloudflare) is a feature that lets you instantly expose your local environment without any configuration. It's ideal for testing and demoing apps under development.

Cloudflare Docs — Quick Tunnels

SSH / RDP Browser Access (Browser Rendering)

By combining Cloudflare Access and Tunnel, you can use SSH and RDP directly from the browser. There is no need to install cloudflared on the client side — users can access them using only a browser.

Protocol	Access Method	Configuration
SSH	In-browser terminal	Enable "Browser rendering" in the Access Application
RDP	In-browser remote desktop	Enable "Browser rendering" in the Access Application
VNC	In-browser VNC client	Enable "Browser rendering" in the Access Application

Cloudflare Docs — SSH connections Cloudflare Docs — RDP connections

Retrieving Tunnel Logs

Enabling Debug Logs (--loglevel debug)

When to use: Use this when troubleshooting Tunnel connection issues, performance problems, or unexpected behavior. If standard logs lack sufficient information, enabling debug-level logging provides detailed connection information, error causes, and request processing status.

Cloudflare Docs — Tunnel Log

If You Have Connection Issues: Checking Firewall Settings

Cloudflare Tunnel implements a "positive security model" that only allows outbound (Egress) traffic from cloudflared and blocks all inbound (Ingress) traffic. If you have connection issues, verify that the following IPs/ports are allowed in your firewall.

Cloudflare Docs — Tunnel with Firewall

Purpose	Domain / IP	Port
Tunnel Connection (Region 1)	region1.v2.argotunnel.com 198.41.192.0/24	TCP/UDP 7844
Tunnel Connection (Region 2)	region2.v2.argotunnel.com 198.41.200.0/24	TCP/UDP 7844
SNI Verification (Optional)	cftunnel.com h2.cftunnel.com (HTTP/2) quic.cftunnel.com (QUIC)	TCP/UDP 7844

Connection Monitoring with DEX (Digital Experience Monitoring)

DEX (Digital Experience Monitoring) is a feature that provides visibility into the performance of devices, networks, and applications across your entire Zero Trust organization. It can be used to isolate connection issues (device / network / Cloudflare) and investigate performance degradation.

Feature	Description	Use Case
Fleet Status	Real-time monitoring of WARP client status and endpoint connectivity	Verifying overall device health, identifying WARP connection issues
HTTP Tests	Periodically measures status codes and response times for specified URLs	Monitoring availability of internal apps via Tunnel, SaaS apps
Traceroute Tests	Measures latency per hop and visualizes the network path	Identifying where latency occurs, isolating network issues
Remote Capture	Remotely collects diagnostic logs and packet captures from user devices	Detailed investigation of individual user connection issues
Notifications	Sends alert notifications when connection degradation or performance drops are detected	Early detection of issues, proactive response

Cloudflare Docs — Digital Experience Monitoring

What is Cloudflare Gateway (SWG)

Cloudflare Gateway functions as a Secure Web Gateway (SWG), a cloud-based security service that inspects, filters, and protects your organization's internet traffic. It replaces traditional on-premises proxies and firewalls, protecting users regardless of location.

Gateway Inspection Layers

Gateway inspects traffic at the following 3 layers, each with its own policy type:

Layer	Inspection Target	Primary Use Cases
DNS	DNS queries (domain name resolution)	Blocking malicious domains, content filtering, shadow IT detection
Network	IP addresses, ports, protocols	Blocking vulnerable ports, restricting traffic to specific IPs, protocol control
HTTP	HTTP/HTTPS requests (URL, headers, body)	Detailed URL filtering, file type restrictions, DLP, malware scanning

Cloudflare Docs — Traffic policies

Configuring DNS Filtering

1. Enable activity logging for Gateway DNS logs in Settings > Network
2. Access any URL from a browser and verify that DNS logs are being captured
3. Configure recommended policies / configure individual policies (optional)

Recommended Block Categories

Cloudflare Gateway classifies domains by category and can block them via DNS policies. We recommend blocking the following categories.

Cloudflare Docs — Domain categories

Recommended DNS Policy List

Below are examples of DNS policies recommended by Cloudflare. Customize according to your organization's security requirements.

Policy Name	Selector	Operator	Value	Action	Purpose
Block security threats	Security Categories	in	All Security Risks	Block	Block malware, phishing, C2 servers, etc.
Block inappropriate content	Content Categories	in	Adult Themes, Gambling, etc.	Block	Block content that violates corporate policies
Block newly seen domains	Security Categories	in	Newly Seen Domains	Block	Recently registered domains (easily exploited for attacks)
Block DGA domains	Security Categories	in	DGA Domains	Block	Domains created by domain generation algorithms
Allow specific domain	Domain	is	example.com	Allow	Allowlist domains required for business operations
Block specific domain	Domain	matches regex	.*\.torrent\..*	Block	Block P2P file-sharing sites

Cloudflare Docs — Recommended DNS policies

Configuring Network Filtering

1. Verify that TCP Proxy is enabled in Settings > Network
2. Enable UDP and ICMP as needed

Recommended Network Policies

Network policies can block traffic based on destination ports and IP addresses. We recommend configuring the following policies.

Cloudflare Docs — Network policies

Recommended Network Policy List

Below are examples of network policies recommended by Cloudflare.

Policy Name	Selector	Operator	Value	Action	Purpose
Block SMB ports	Destination Port	in	135, 136, 137, 138, 139, 445	Block	Prevent ransomware spread (WannaCry, etc.)
Block Telnet	Destination Port	is	23	Block	Prevent credential leaks via plaintext communication
Block FTP	Destination Port	in	20, 21	Block	Block plaintext file transfers
Block RDP	Destination Port	is	3389	Block	Block external RDP connections
Allow SSH	Destination Port	is	22	Allow	Allow encrypted remote access
Block specific IPs	Destination IP	in	(Threat IP list)	Block	Block traffic to known malicious IPs

Cloudflare Docs — Recommended Network policies

Configuring HTTP Filtering

1. Configure TLS decryption (Settings > Network)
2. Install the TLS certificate on each device
3. Enable activity logging for Gateway HTTP logs
4. Configure recommended policies / configure individual policies

Recommended HTTP Policy List

Below are examples of HTTP policies recommended by Cloudflare. HTTP policies are most effective when TLS decryption is enabled.

Policy Name	Selector	Operator	Value	Action	Purpose
Block security threats	Security Risks	in	All Security Risks	Block	Block malware, phishing, and other threats
Block dangerous file types	Download File Types	in	exe, dll, bat, cmd, ps1, vbs	Block	Prevent downloading executable files
Malware scan	Download File Types	in	All File Types	Scan	Malware scan of downloaded files
Block uploads	Upload File Types	in	(Sensitive file types)	Block	Prevent external uploads of sensitive data
Exclude from TLS inspection	Application	in	Zoom, Teams, etc.	Do Not Inspect	Exclude apps that use certificate pinning
Browser isolation	Security Risks	in	Suspicious, Unknown	Isolate	Isolate suspicious sites with RBI
Make SaaS apps read-only	Application	in	Google Drive, Dropbox	Isolate (disable uploads)	Prevent uploads to personal SaaS accounts

Cloudflare Docs — Recommended HTTP policies

Configuring Egress Policies

Requires the purchase of Dedicated Egress IPs. Once configured, specific traffic can be routed outbound from a designated Egress IP. This is useful for system integrations that require a fixed source IP (e.g., SaaS services with IP allowlist restrictions).

Cloudflare Docs — Egress policies

Configuring Resolver Policies

You can switch the DNS Resolver applied per request. Note the differences from Local Domain Fallback.

Method	DNS Filtering	Use Case
Default DNS Resolver (1.1.1.1)	✅ Applied	Standard external name resolution
Resolver Policy (internal DNS specified)	✅ Applied	Use internal DNS while maintaining filtering
Local Domain Fallback	❌ Not applied	Internal name resolution bypassing Cloudflare

Tenant Control

This feature allows access only to corporate-approved SaaS accounts and blocks access via personal accounts. It works by injecting custom headers specific to each SaaS application into traffic passing through Gateway.

Supported Application	Custom Header
Microsoft 365	Restrict-Access-To-Tenants, Restrict-Access-Context
Google Workspace	X-GooGApps-Allowed-Domains
Slack	X-Slack-Allowed-Workspaces
Dropbox	X-Dropbox-allowed-Team-Ids
ChatGPT	Chatgpt-Allowed-Workspace-Id

Cloudflare Docs — Tenant control

Configuring DNS Locations

DNS filtering can be applied to devices without WARP installed (agentless) by pointing their resolver to a DNS Locations endpoint. This is suitable for office routers and devices with static IPs.

Cloudflare Docs — Add locations

Configuring Proxy Endpoints

HTTP filtering can be applied to devices without WARP installed by specifying a Proxy Endpoint in the device's PAC file.

Cloudflare Docs — PAC files

Gateway Rule Evaluation Order

Cloudflare Gateway allows you to use DNS / Network / HTTP policies in combination. Traffic is evaluated against policies in the following order.

Priority Between Policy Builders

Gateway applies policies in the following order:

1. DNS policies (selectors evaluated before resolution)
2. Resolver policies (if applicable; Enterprise only)
3. DNS policies (selectors evaluated after resolution)
4. Egress policies (if applicable; Enterprise only)
5. Network policies
6. HTTP policies

Evaluation Order Within HTTP Policies

HTTP policies are applied based on a combination of action type and priority:

Precedence Principles

Within each policy builder, the First Match principle applies. When traffic matches an Allow or Block policy, evaluation stops and subsequent policies are not evaluated.

Recommendation	Description
High priority (lower number)	Set the most specific policies and exceptions
Low priority (higher number)	Set the most general policies

Cloudflare Docs — Order of enforcement

Leveraging the Do Not Inspect Action

Do Not Inspect is an action that bypasses TLS decryption (inspection) for specific traffic. Use it for apps that use certificate pinning or services that are incompatible with TLS inspection.

Method	TLS Inspection	Logging	Use Case
Do Not Inspect	❌ Bypassed	✅ Logged	Certificate pinning apps, TLS-incompatible services
Split Tunnel (Exclude)	❌ Bypassed	❌ Not logged	Bandwidth savings, complete bypass

When to use Do Not Inspect:

• During troubleshooting — If an app doesn't work with TLS inspection, first check if Do Not Inspect resolves the issue. Since logs are retained, root cause identification is easier
• Maintaining visibility — When you can't inspect traffic but still want to know which users accessed which services and when
• Gradual exclusion — Before fully excluding with Split Tunnel, use Do Not Inspect to assess impact while reviewing logs
• Compliance requirements — When specific traffic cannot be inspected but access records are required

RBI Overview

Remote Browser Isolation (RBI) is a security technology that executes web browsing in an isolated cloud environment to protect endpoints. Only safe rendering results are sent to the user's browser, preventing malware and malicious code from reaching the local device.

To apply RBI, create a policy in Gateway > Traffic Policies > HTTP and select Isolate as the action. By applying the Isolate action to specific categories (e.g., security risks, uncategorized sites) or specific domains/URLs, you can safely browse high-risk web content in an isolated environment.

RBI Operating Modes

Mode	Description	Characteristics
Clientless Isolation	Isolates the browser via a dedicated URL	No agent required, ideal for accessing specific apps
WARP + Gateway integration	Applies the Isolate action via HTTP policies	Works transparently, users are unaware of isolation

Benefits of RBI

RBI Use Cases

Use Case	Description	Configuration Example
Accessing sensitive assets	Prevent data exfiltration when accessing internal sensitive systems	Isolate + disable copy when accessing specific domains
Browsing high-risk sites	Browse uncategorized or newly seen domains in an isolated environment	Apply Isolate action to Security Risk categories
BYOD / Unmanaged devices	Protect when accessing internal resources from personal devices	Isolate specific apps with Clientless Isolation
Safe use of generative AI	Use ChatGPT etc. in an isolated environment to prevent pasting of sensitive data	Isolate + disable paste on AI domains

Cloudflare Docs — Browser Isolation

DLP / CASB / Device Posture Overview

Cloudflare Zero Trust provides multiple features for data protection and security posture management. Understanding the differences between each feature helps you deploy the right combination.

Feature	Scan Target	Role	Notes
DLP	Data content	Scans and evaluates sensitive information in traffic and files	Filtering in Gateway based on evaluation results
CASB	Configuration (posture)	Scans and evaluates security settings of SaaS apps	DLP feature required for file scanning
CASB + DLP	Both data and configuration (data + posture)	Scans files and traffic content in SaaS / cloud storage	Combines DLP file scanning with CASB
Device Posture	Device information (posture)	WARP scans the state of user devices	Implement blocking etc. via Gateway / Access policies

What is Cloudflare CASB

Cloudflare CASB (Cloud Access Security Broker) is a service that provides visibility into the security posture of SaaS applications used by your organization and detects misconfigurations and data leak risks. Through API integration, it can directly scan data and user activity within SaaS apps.

CASB Operating Modes

Mode	How It Works	Characteristics
API mode	Connects directly to SaaS app APIs to scan	No agent required, can inspect existing data, periodic automatic scans
Inline mode	Real-time inspection of traffic via Gateway	Real-time protection, works with DLP, inspects during uploads/downloads

Risks Detectable by CASB

Supported SaaS Applications (Examples)

Finding Severity Levels

Severity	Description	Response Priority
Critical	Critical security risks requiring immediate action (e.g., fully public files, unauthenticated external sharing)	Highest priority
High	Significant misconfigurations or excessive permissions (e.g., edit permissions for everyone, MFA disabled)	Address within 48 hours
Medium	Risky configurations (e.g., suspicious external users, excessive app integration permissions)	Address within 1 week
Low	Recommended improvements (e.g., inactive users, outdated settings)	Address during periodic reviews

Content Finding Types and Responses

Finding Category	Example Detections	Recommended Response
Data leak risk	External sharing links for sensitive files, public access settings	Remove sharing links / restrict permissions
Misconfiguration	Users without MFA, excessive admin permissions	Enforce MFA / minimize permissions
Shadow IT	Use of unapproved SaaS tools, unknown app integrations	Establish app integration approval process / block
User risk	Remaining accounts of former employees, inactive users	Disable / delete accounts
Compliance	Data retention policy violations, data stored outside geographic restrictions	Review policy settings / migrate data

Finding Response Flow

1. Review the list in Cloud & SaaS findings > Findings → Filter by Severity (Critical / High first)
2. Review Finding details → Identify affected files, users, and settings
3. Fix settings on the SaaS app side (e.g., remove sharing links, enable MFA)
4. After the next automatic scan, confirm the Finding has been resolved (Active Instances cleared)
5. For recurring Findings, consider controlling via Gateway / Access policies

Cloudflare Docs — Manage CASB findings Cloudflare Docs — CASB

Adding an Integration

1. Go to Cloud & SaaS findings > Integrations and click "Add integration"
2. Select the SaaS Integration → Follow the instructions to configure → Click "Save"
3. Review security issues on the Finding page

Pausing / Removing an Integration

1. Go to Cloud & SaaS findings > Integrations and select "Configure" for the target Integration
2. Disable "Scan for findings" (pause) or click "Disenroll" (remove)

What is Cloudflare DLP

Cloudflare DLP (Data Loss Prevention) is a service that prevents sensitive data leaks. It scans HTTP traffic and file contents to detect and block sensitive data such as credit card numbers, personal information, and source code from leaving the organization.

File Formats and Size Limits Scannable by DLP

Category	Supported Formats
Text	Text files (.txt), CSV
Microsoft Office	Word (.docx), Excel (.xlsx), PowerPoint (.pptx) *2007 and later, including Microsoft 365
PDF	.pdf (scans text content)
ZIP (compressed)	ZIP files containing the above formats (up to 10 levels of recursive extraction)

DLP Detection Targets

Category	Detection Examples	Notes
AI Prompts	Security, Customer, Financial Information, PII, Technical	Detects sensitive information input to generative AI + Prompt Protection / Guardrails supported
Credentials / Passwords	GCP / AWS / Azure API keys, SSH keys	Prevents cloud credential leaks
Financial Information	Credit card numbers, VISA card numbers	PCI-DSS compliance
Health Information (PHI)	FDA active ingredients / drug names, ICD-10 codes	Medical data protection
Social Security / ID Numbers	Social security numbers, insurance numbers, taxpayer IDs	*Japan's My Number is not supported natively (available via custom profile)
Source Code	C, C++, C#, Go, Java, JavaScript, Python, Rust, Swift, etc.	Intellectual property protection, prevent external code sharing
Custom Patterns	Defined via regex (employee IDs, project codes, My Number, etc.)	Organization-specific data protection requirements

Addressing Generative AI (ChatGPT, etc.)

The risk of data leaks from employees inputting sensitive information into generative AI services is increasing. DLP enables the following countermeasures:

🎬 Related Demo Videos

DLP Deployment Methods

Method	Description	Requirements
Inline Inspection	Scan traffic in real time via Gateway HTTP policies	WARP client + TLS inspection enabled
CASB Integration	Scan existing data in SaaS apps via API	CASB Integration configured

Cloudflare Docs — Data Loss Prevention

Configuring DLP Profiles

1. Go to DLP > DLP Profile and select the target Managed Profile → "Configure"
2. Select the Detection Entries you want to enable → "Save Profile"
3. Add Custom Profiles as needed

Commonly Used Managed Profiles

Profile Name	Detection Target	Use Case
Financial Information	Credit card numbers, bank account numbers	PCI-DSS compliance
Credentials and Secrets	API keys (AWS / GCP / Azure), SSH keys, passwords	Prevent cloud credential leaks
Source Code	Python, JavaScript, Java, Go, Rust, etc.	Intellectual property protection, prevent input to generative AI
AI Prompt	Security, Customer, Financial, PII, Technical information	Detect sensitive information input to generative AI

Common DLP Policy Examples

Policy	Description	Action
Log Uploads / Downloads	Log when Financial Information is uploaded / downloaded to file-sharing apps	Allow (log only)
Block File Types	Block upload / download of specific file formats (.docx, .pdf, etc.)	Block
Block Specific Users	Block sensitive data uploads for specific groups only (e.g., contractors)	Block (with Identity condition)

Cloudflare Docs — Configure a DLP profile Cloudflare Docs — Common DLP policies

Creating a DLP Policy

1. Generate a key pair with matched-data-cli:
   $ ./matched-data-cli generate-key-pair
2. Go to Traffic policies > Traffic settings and enter the public key in "Set a DLP payload and prompt encryption public key" → Save
3. Go to Gateway > Data Loss Prevention > DLP Profiles to create / edit profiles
4. Go to Gateway > Traffic Policies > HTTP → "Add a policy" → Select "DLP Profile" in the Selector
5. Check "Log the payload of matched rule" → "Create a policy"

Cloudflare Docs — Create a DLP policy

Reviewing DLP Logs

1. Go to Logs > Gateway > HTTP and filter by DLP policy
2. Select the relevant record → "Decrypt payload log" and enter the Private Key

CASB Integration — Scan for Sensitive Data

By combining CASB and DLP, you can detect sensitive data leaks in SaaS apps. Results can be reviewed in both CASB Findings and DLP logs.

Cloudflare Docs — Scan for sensitive data

Response Headers:
─────────────────────────────────────────────
cf-ray: 8a1b2c3d4e5f6789-NRT
cf-cache-status: DYNAMIC
content-type: text/html; charset=UTF-8
date: Sat, 22 Feb 2026 08:00:00 GMT
server: cloudflare
...

1. Pre-Troubleshooting Checklist

2. Collecting Diagnostic Logs

Diagnostic logs can be collected via the Cloudflare Dashboard or the warp-diag CLI.

After execution, warp-debugging-info-<date>-<time>.zip is saved to the desktop (or execution folder).

3. Checking Important Files

WARP diagnostic logs include the final configuration and status after MDM policy application.

File	Contents
warp-status.txt	WARP connection status, mode, and account information
warp-settings.txt	Applied profile ID, Split Tunnel settings, mode configuration
daemon.log	Detailed WARP daemon logs (connection errors, authentication issues, etc.)

4. Fixing Common Configuration Mistakes

Problem	Checkpoint	Solution
Incorrect Profile ID	Compare the Profile ID in warp-settings.txt with Dashboard settings	Check profile priority, Managed Network settings, and user groups
Incorrect Split Tunnel Settings	Verify Exclude/Include mode and target IPs/domains	Toggle WARP off/on, or reset encryption keys to re-fetch settings

Error 526: Untrusted Certificate

When Gateway displays an HTTP Response Code: 526 error page, there is an issue with the origin server's certificate.

Cause	Description
Unknown certificate issuer	The server certificate issuer is not trusted by Gateway
Revoked certificate	The server certificate failed the CRL check
Expired certificate chain	An expired certificate exists in the certificate chain
Common Name mismatch	The certificate's Common Name does not match the target URL
Invalid characters in Common Name	Contains invalid characters such as underscores (Gateway uses BoringSSL)
Insecure cipher suites	Only supports insecure cipher suites such as RC4, RC4-MD5, 3DES

Error 502: Bad Gateway

This can occur when communicating with origins that partially support HTTP/2.

Cause	Description
HTTP/2 downgrade request	The origin starts a connection via HTTP/2, then requests a downgrade to HTTP/1.1 for some requests
IIS Server	Microsoft IIS may not support authentication over HTTP/2

Certificate Warning: Untrusted Certificate

If certificate warnings appear on all pages and you cannot browse the internet:

1. Verify the Cloudflare root certificate is installed on the device
2. Confirm "Install CA to system certificate store" is enabled under Team & Resources > Devices > WARP Client
3. Restart the browser (Chrome/Edge caches certificates at startup)

Certificate Errors in Mobile Apps

Even after installing the Cloudflare certificate on the system, some mobile apps may display invalid certificate warnings.

Cause	Solution
Certificate pinning	When an app expects a specific certificate, it won't match the certificate dynamically generated by Gateway

WARP Registration Error: Authentication Expired

If "Authentication Expired" or "Registration error" appears when trying to register the WARP client with a Zero Trust domain:

Cause	Solution
System clock drift	Verify system time accuracy at time.is (within 20 seconds)
Authentication delay	Open the WARP client within 1 minute after the Access prompt

Firefox: Network Protocol Violation

If this warning appears when using WARP with Firefox, disable the DNS over HTTPS setting in Firefox.

1. Open Firefox settings
2. Search for "Privacy & Security" → "DNS over HTTPS"
3. Set "Enable DNS over HTTPS" to off

Chrome: NET::ERR_CERT_AUTHORITY_INVALID

If this error appears when using WARP with Chrome:

1. Verify the Cloudflare root certificate is installed
2. Update the WARP client to the latest version
3. Fully restart the browser (Chrome caches root certificates at startup)

Best Practices When Contacting Support

For faster resolution, include the following information in your support ticket:

Item	Details
Context	User's location and a brief description of the operation they were trying to perform
Reproduction Steps	Specific steps to reproduce the issue
Timestamp	Time of occurrence (including time zone)
Troubleshooting History	Summary of solutions already attempted
WARP Diagnostic Logs	Attach the ZIP file collected via warp-diag